CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1032 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-9990 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2017 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #:… | ||
| CVE-2016-6209 | Med | 0.40 | 6.1 | 0.02 | Mar 31, 2017 | Cross-site scripting (XSS) vulnerability in Nagios. | ||
| CVE-2017-7363 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2017 | Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack. | ||
| CVE-2017-7362 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2017 | Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack. | ||
| CVE-2017-7361 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2017 | Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack. | ||
| CVE-2017-7360 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2017 | Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack. | ||
| CVE-2017-7359 | Med | 0.40 | 6.1 | 0.01 | Mar 31, 2017 | Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack. | ||
| CVE-2017-7320 | Med | 0.40 | 6.1 | 0.01 | Mar 30, 2017 | setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting… | ||
| CVE-2016-6846 | Med | 0.40 | 6.1 | 0.01 | Mar 29, 2017 | Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47, 7.8.0 before 7.8.0-rev30, and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16, 7.8.0… | ||
| CVE-2017-2687 | Med | 0.40 | 6.1 | 0.01 | Mar 29, 2017 | Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability in the integrated web server at port 10000/TCP which is prone to reflected Cross-Site Scripting attacks if an unsuspecting user is induced to click on a malicious link. | ||
| CVE-2016-9466 | Med | 0.40 | 6.1 | 0.02 | Mar 28, 2017 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence… | ||
| CVE-2016-9459 | Med | 0.40 | 6.1 | 0.01 | Mar 28, 2017 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with… | ||
| CVE-2017-1120 | Med | 0.40 | 6.1 | 0.01 | Mar 27, 2017 | IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference… | ||
| CVE-2015-8010 | Med | 0.40 | 6.1 | 0.01 | Mar 27, 2017 | Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi. | ||
| CVE-2017-6067 | Med | 0.40 | 6.1 | 0.01 | Mar 27, 2017 | Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field. | ||
| CVE-2017-6003 | Med | 0.40 | 6.1 | 0.01 | Mar 27, 2017 | dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the bottom two form fields. | ||
| CVE-2017-2645 | Med | 0.40 | 6.1 | 0.01 | Mar 26, 2017 | In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. | ||
| CVE-2017-7250 | Med | 0.40 | 6.1 | 0.01 | Mar 23, 2017 | A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (action) passed to the 'Gazelle-master/sections/tools/finances/bitcoin_balance.php' URL. An attacker could execute arbitrary… | ||
| CVE-2017-7249 | Med | 0.40 | 6.1 | 0.01 | Mar 23, 2017 | Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data (action, userid) passed to the 'Gazelle-master/sections/tools/data/ocelot_info.php' URL. An attacker could execute… | ||
| CVE-2017-7248 | Med | 0.40 | 6.1 | 0.01 | Mar 23, 2017 | A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (type) passed to the 'Gazelle-master/sections/better/transcode.php' URL. An attacker could execute arbitrary HTML and script… |
- risk 0.40cvss 6.1epss 0.01
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #:…
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in Nagios.
- risk 0.40cvss 6.1epss 0.01
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.
- risk 0.40cvss 6.1epss 0.01
Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.
- risk 0.40cvss 6.1epss 0.01
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.
- risk 0.40cvss 6.1epss 0.01
Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.
- risk 0.40cvss 6.1epss 0.01
Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.
- risk 0.40cvss 6.1epss 0.01
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47, 7.8.0 before 7.8.0-rev30, and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16, 7.8.0…
- risk 0.40cvss 6.1epss 0.01
Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability in the integrated web server at port 10000/TCP which is prone to reflected Cross-Site Scripting attacks if an unsuspecting user is induced to click on a malicious link.
- risk 0.40cvss 6.1epss 0.02
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence…
- risk 0.40cvss 6.1epss 0.01
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with…
- risk 0.40cvss 6.1epss 0.01
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference…
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.
- risk 0.40cvss 6.1epss 0.01
Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.
- risk 0.40cvss 6.1epss 0.01
dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the bottom two form fields.
- risk 0.40cvss 6.1epss 0.01
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (action) passed to the 'Gazelle-master/sections/tools/finances/bitcoin_balance.php' URL. An attacker could execute arbitrary…
- risk 0.40cvss 6.1epss 0.01
Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data (action, userid) passed to the 'Gazelle-master/sections/tools/data/ocelot_info.php' URL. An attacker could execute…
- risk 0.40cvss 6.1epss 0.01
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (type) passed to the 'Gazelle-master/sections/better/transcode.php' URL. An attacker could execute arbitrary HTML and script…